48a2db38aba347d0f611cac788d63cc612bbb5cee9b2109a18525e84923040db

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 13:46

Target

Basement.dll
Size

3.1MB
MD5

ef9b2730c2fa313edb30e80506ea7c9b
SHA1

5de4a22f1af3f0fce4c2289e1051fbf39be542ac
SHA256

fe767b3f9fbc789e912db49da540f382e7e6368c6429a685d17178196bd40f00
SHA512

fadd0b7378bc211cdff2776981e03441705a841ce1d3c996ed79024a90481a8edc58451d06b6f8b43c70325c0dde0181ea3bbbf939ac1ab7278114ad69b5189a
SSDEEP

24576:k75QZ5MljCctWvnTFj0WDiOUmDPhFgrn4IDfkObhib+GAl+V/AmmqJA2oSMXEyDD:kFQAjZW/TF9DUgtj/edDU+FTp3SJAT

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4160 wrote to memory of 5004	4160	regsvr32.exe	84
PID 4160 wrote to memory of 5004	4160	regsvr32.exe	84
PID 4160 wrote to memory of 5004	4160	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Basement.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4160
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\Basement.dll
  2⤵
  PID:5004